Cloud Edge Secure Access Getting Started Guide

Active Directory Federation Services (ADFS)

This article describes how to configure ADFS to use as an identity provider for SonicWall Cloud Edge.

Please follow the steps below:

Launch your instance of ADFS and start the Add Relying Party Trust wizard.

On the Welcome page, choose Claims aware and click Start.
On the Select Data Source page, select Enter data about the relying party manually and click Next.
On the Specify Display Name page, provide a descriptive name for your relying party (the typical name isSonicWall Cloud Edge) and a brief description under Notes. Click Next.
On the Configure Certificate page, click Next.
On the Configure URL page, check the box for Enable support for the SAML 2.0 WebSSO protocol.
Set Relying party SAML 2.0 SSO service URL to https://{{YOUR.ADFS.DOMAIN}}/login/callback?connection={{WORKSPACE}}-oc . Click Next .
On the Configure Identifiers page, set the Relying party trust identifier to urn:auth0:sonicwalledge:{{WORKSPACE}}-oc. Click Add and Next.
On the Choose Access Control Policy page, select Permit everyone and click Next.
Review the settings you provided on the Ready to Add Trust page and click Next to save your information. If you were successful, you'll see a message indicating that on the Finish page.
Make sure that the Configure claims issuance policy for this application checkbox is selected, and click Close.

After you close the Add Relying Party Trust wizard, the Edit Claim Issuance Policy window appears.

Click Add Rule... to launch the wizard.
Select Send LDAP Attributes as Claims for your Claim rule template, and click Next.
Provide a value for the Claim rule name, such as "LDAP Attributes" (it can be anything you want).
Choose Active Directory as your Attribute Store.

Map your LDAP attributes to the following outgoing claim types:

E-mail Addresses	email
Given-Name	given_name
Surname	family_name
Token-Groups Unqualified-Names	groups
User-Principal-Name	user_id

Click Finish.
In the Edit Claim Issuance Policy window, click Apply. You can now exit out of this window.

Using the left-hand navigation pane, go to ADFS > Service > Certificates.
Select the Token-signing certificate, and right-click to select View Certificate.
On the Details tab, click Copy to File...
In the Certificate Export Wizard Click Next.
Choose Base-64 encoded X.509 (.CER) . Click Next.
Provide the location for the certificate to be exported. Click Next.
Verify that the certificate and click Finish.

At this point, you will configure the integration from the SonicWall Cloud Edge side.

Log in to your SonicWall Cloud Edge Management Platform, and navigate to Settings and then Identity Providers.
Select + Add Provider.
Choose SAML 2.0 Identity Providers.
Sign In URL: https://{{YOUR.ADFS.DOMAIN}}/adfs/ls.
Add your organization domain.
Open the ADFS X.509 certificate file in a UNIX operating system and paste its content into the X509 Signing Certificate box.
Select Save.